SKILupDay

There might be some pointy knifes at the beginning, but get them to talk, empathise #DevSecOps #DevOpsInstitute #SKILupDay

The new DevSecOps Foundation course 2.0 - just released!

Information Security Training

Also, we have a DevSecOps SKILbook being put together - stay tuned!

Fits with @PlanetKristine 's question perfectly...

Because it always results in escalation and unnecessary visibility and at times resulting in job.

Drills should be done with everything, as fire departments deal with fires by drilling, you cannot expect any team to be able to deal with a threat if they have not practiced enough to be in control of the situation #DevSecOps #DevOpsInstitute #SKILupDay

good to have your roof repaired when sun is shining but unfortunately that's the time when the people are least bothered. #DevSecops #DevOps

Ppl are scared especially in the legacy environment because before agile , devops, ppl were working in in silo mode and if they open that pandora box that might even kill the business :)

wait, whose not doing security drillls? Proper exercise is essential ops

Indeed a good question, and most of the times it is a part of chaos engineering, so yeah i consider that as a drill too.

Ethical Hacking, Pen Testing, Risk Management and Disaster Recovery drills should be an ongoing thing.

Aaron has a good post about it https://opensource.com/article/18/1/new-paradigm-c....

Automation! There are many great sources of information, including very secure and free. Such as https://www.mitre.org/centers/national-security-an...

(edited)

regular (mandatory) training. Interactive Exercises by organization on regular basis. #DevSecOps #DevOps

Security is always a losing race, for me personally it's always a question of making it as difficult/slow as possible to be able to detect threads with enough time #DevSecOps #DevOpsInstitute #SKILupDay

Having a robust Security policy and build a autonomous process that can bring the visibility on the security issues that needs to be addressed and measuring the existing and new security issues in the organization.

Monitoring a threatening model all the time

use advanced solutions ahead of next security threat. Rapid telease and deploy with updated cose

Hackers #DevSecOps #DevOpsInstitute #SKILupDay #HackThePlanet

Devops without security definitely a horror movie :)

(edited)

@vishnube good one!

"when harry met sally"

perfect !

Conjuring DevOps

What do you know about security ¡¡¡¡

@alalit You read my mind :)

What Security Wants

Beetlejuce

I know what you did (in the) last release!!

lol

Three amigos

War room !

It triggers a security incident that gets escalated to all the adequate teams to deal with it ASAP #DevSecOps #DevOpsInstitute #SKILupDay

Panic. Zoom. Repeat.

All hands on deck. Fix it, get the root cause and make sure it is not repeated at any cost.

Find out who did it!

And beat them up!

@BealHelen nah, just career limit them and make their life miserable for a while... LOL, just kidding (mostly)

what does high critical definition means to the employees. Impact, Urgency & Priority is decided then accordingly. #DevSecOps #DevOps

lol

Most of the time, nobody knows what to do ....

Do you see a sudden rise in PTOs? :-)

interesting point @lynxman

to me it has to be at the maximum level for an organization or a product to grow. Without security no code should be moved to prod.

yes definitely, this way you understand from a product perspective what are the must have vs the nice to have #DevSecOps #DevOpsInstitute #SKILupDay

Oof. No. Security is part and parcel of every long-lived product - any incremental change must have security NFRs and NFTs attached at the earliest opportunity. Automate it to make it easier to get the security test coverage you want.

Security MUST BE CONSIDERED when you define a MVP

Nooopeess... it's critical and integral for *all* projects in 2020!

automation is key and also CISO should have leverage over any product that is being pushed to prod and have a direct relationship with the Engineering team to avoid security issues.

No, critical from project conception.

Agreed, and in most organizations there is policy that software isn't put into production without security review. This require security reviews, and frequently a triage that determines whether or not the risk will be assumed, or responsibility abdicated.

Security should be PART of a minimum viable product (MVP). And be considered as a functional requirement rather non-functional. #DevSecOps #DevOps